src/PVE/LXC/Setup.pm

   1 package PVE::LXC::Setup;
   2
   3 use strict;
   4 use warnings;
   5 use POSIX;
   6 use PVE::Tools;
   7
   8 use Cwd 'abs_path';
   9
  10 use PVE::LXC::Setup::Debian;
  11 use PVE::LXC::Setup::Ubuntu;
  12 use PVE::LXC::Setup::CentOS;
  13 use PVE::LXC::Setup::Fedora;
  14 use PVE::LXC::Setup::SUSE;
  15 use PVE::LXC::Setup::ArchLinux;
  16 use PVE::LXC::Setup::Alpine;
  17 use PVE::LXC::Setup::Gentoo;
  18 use PVE::LXC::Setup::Devuan;
  19
  20 my $plugins = {
  21     debian    => 'PVE::LXC::Setup::Debian',
  22     devuan    => 'PVE::LXC::Setup::Devuan',
  23     ubuntu    => 'PVE::LXC::Setup::Ubuntu',
  24     centos    => 'PVE::LXC::Setup::CentOS',
  25     fedora    => 'PVE::LXC::Setup::Fedora',
  26     opensuse  => 'PVE::LXC::Setup::SUSE',
  27     archlinux => 'PVE::LXC::Setup::ArchLinux',
  28     alpine    => 'PVE::LXC::Setup::Alpine',
  29     gentoo    => 'PVE::LXC::Setup::Gentoo',
  30 };
  31
  32 # a map to allow supporting related distro flavours
  33 my $plugin_alias = {
  34     arch => 'archlinux',
  35     sles => 'opensuse',
  36     'opensuse-leap' => 'opensuse',
  37     'opensuse-tumbleweed' => 'opensuse',
  38 };
  39
  40 my $autodetect_type = sub {
  41     my ($self, $rootdir, $os_release) = @_;
  42
  43     if (my $id = $os_release->{ID}) {
  44         return $id if $plugins->{$id};
  45         return $plugin_alias->{$id} if $plugin_alias->{$id};
  46         warn "unknown ID '$id' in /etc/os-release file, trying fallback detection\n";
  47     }
  48
  49     # fallback compatibility checks
  50
  51     my $lsb_fn = "$rootdir/etc/lsb-release";
  52     if (-f $lsb_fn) {
  53         my $data =  PVE::Tools::file_get_contents($lsb_fn);
  54         if ($data =~ m/^DISTRIB_ID=Ubuntu$/im) {
  55             return 'ubuntu';
  56         }
  57     }
  58
  59     if (-f "$rootdir/etc/debian_version") {
  60         return "debian";
  61     } elsif (-f "$rootdir/etc/devuan_version") {
  62         return "devuan";
  63     } elsif (-f  "$rootdir/etc/SuSE-brand" || -f "$rootdir/etc/SuSE-release") {
  64         return "opensuse";
  65     } elsif (-f  "$rootdir/etc/fedora-release") {
  66         return "fedora";
  67     } elsif (-f  "$rootdir/etc/centos-release" || -f "$rootdir/etc/redhat-release") {
  68         return "centos";
  69     } elsif (-f  "$rootdir/etc/arch-release") {
  70         return "archlinux";
  71     } elsif (-f  "$rootdir/etc/alpine-release") {
  72         return "alpine";
  73     } elsif (-f  "$rootdir/etc/gentoo-release") {
  74         return "gentoo";
  75     } elsif (-f "$rootdir/etc/os-release") {
  76         die "unable to detect OS distribution\n";
  77     } else {
  78         warn "/etc/os-release file not found and autodetection failed, falling back to 'unmanaged'\n";
  79         return "unmanaged";
  80     }
  81 };
  82
  83 sub new {
  84     my ($class, $conf, $rootdir, $type) = @_;
  85
  86     die "no root directory\n" if !$rootdir || $rootdir eq '/';
  87
  88     my $self = bless { conf => $conf, rootdir => $rootdir};
  89
  90     my $os_release = $self->get_ct_os_release();
  91
  92     if ($conf->{ostype} && $conf->{ostype} eq 'unmanaged') {
  93         return $self;
  94     } elsif (!defined($type)) {
  95         # try to autodetect type
  96         $type = &$autodetect_type($self, $rootdir, $os_release);
  97         my $expected_type = $conf->{ostype} || $type;
  98
  99         if ($type ne $expected_type) {
 100             warn "WARNING: /etc not present in CT, is the rootfs mounted?\n"
 101                 if ! -e "$rootdir/etc";
 102             warn "got unexpected ostype ($type != $expected_type)\n"
 103         }
 104     }
 105
 106     if ($type eq 'unmanaged') {
 107         $conf->{ostype} = $type;
 108         return $self;
 109     }
 110
 111     my $plugin_class = $plugins->{$type} ||
 112         "no such OS type '$type'\n";
 113
 114     my $plugin = $plugin_class->new($conf, $rootdir, $os_release);
 115     $self->{plugin} = $plugin;
 116     $self->{in_chroot} = 0;
 117
 118     # Cache some host files we need access to:
 119     $plugin->{host_resolv_conf} = PVE::INotify::read_file('resolvconf');
 120     $plugin->{host_localtime} = abs_path('/etc/localtime');
 121
 122     # pass on user namespace information:
 123     my ($id_map, $rootuid, $rootgid) = PVE::LXC::parse_id_maps($conf);
 124     if (@$id_map) {
 125         $plugin->{id_map} = $id_map;
 126         $plugin->{rootuid} = $rootuid;
 127         $plugin->{rootgid} = $rootgid;
 128     }
 129
 130     return $self;
 131 }
 132
 133 # Forks into a chroot and executes $sub
 134 sub protected_call {
 135     my ($self, $sub) = @_;
 136
 137     # avoid recursion:
 138     return $sub->() if $self->{in_chroot};
 139
 140     pipe(my $res_in, my $res_out) or die "pipe failed: $!\n";
 141
 142     my $child = fork();
 143     die "fork failed: $!\n" if !defined($child);
 144
 145     if (!$child) {
 146         close($res_in);
 147         # avoid recursive forks
 148         $self->{in_chroot} = 1;
 149         eval {
 150             my $rootdir = $self->{rootdir};
 151             chroot($rootdir) or die "failed to change root to: $rootdir: $!\n";
 152             chdir('/') or die "failed to change to root directory\n";
 153             my $res = $sub->();
 154             if (defined($res)) {
 155                 print {$res_out} "$res";
 156                 $res_out->flush();
 157             }
 158         };
 159         if (my $err = $@) {
 160             warn $err;
 161             POSIX::_exit(1);
 162         }
 163         POSIX::_exit(0);
 164     }
 165     close($res_out);
 166     my $result = do { local $/ = undef; <$res_in> };
 167     while (waitpid($child, 0) != $child) {}
 168     if ($? != 0) {
 169         my $method = (caller(1))[3];
 170         die "error in setup task $method\n";
 171     }
 172     return $result;
 173 }
 174
 175 sub template_fixup {
 176     my ($self) = @_;
 177
 178     return if !$self->{plugin}; # unmanaged
 179
 180     my $code = sub {
 181         $self->{plugin}->template_fixup($self->{conf});
 182     };
 183     $self->protected_call($code);
 184 }
 185
 186 sub setup_network {
 187     my ($self) = @_;
 188
 189     return if !$self->{plugin}; # unmanaged
 190
 191     my $code = sub {
 192         $self->{plugin}->setup_network($self->{conf});
 193     };
 194     $self->protected_call($code);
 195 }
 196
 197 sub set_hostname {
 198     my ($self) = @_;
 199
 200     return if !$self->{plugin}; # unmanaged
 201
 202     my $code = sub {
 203         $self->{plugin}->set_hostname($self->{conf});
 204     };
 205     $self->protected_call($code);
 206 }
 207
 208 sub set_dns {
 209     my ($self) = @_;
 210
 211     return if !$self->{plugin}; # unmanaged
 212
 213     my $code = sub {
 214         $self->{plugin}->set_dns($self->{conf});
 215     };
 216     $self->protected_call($code);
 217 }
 218
 219 sub set_timezone {
 220     my ($self) = @_;
 221
 222     return if !$self->{plugin}; # unmanaged
 223     my $code = sub {
 224         $self->{plugin}->set_timezone($self->{conf});
 225     };
 226     $self->protected_call($code);
 227 }
 228
 229 sub setup_init {
 230     my ($self) = @_;
 231
 232     return if !$self->{plugin}; # unmanaged
 233
 234     my $code = sub {
 235         $self->{plugin}->setup_init($self->{conf});
 236     };
 237     $self->protected_call($code);
 238 }
 239
 240 sub set_user_password {
 241     my ($self, $user, $pw) = @_;
 242
 243     return if !$self->{plugin}; # unmanaged
 244
 245     my $code = sub {
 246         $self->{plugin}->set_user_password($self->{conf}, $user, $pw);
 247     };
 248     $self->protected_call($code);
 249 }
 250
 251 sub rewrite_ssh_host_keys {
 252     my ($self) = @_;
 253
 254     return if !$self->{plugin}; # unmanaged
 255
 256     my $conf = $self->{conf};
 257     my $plugin = $self->{plugin};
 258     my $rootdir = $self->{rootdir};
 259
 260     return if ! -d "$rootdir/etc/ssh";
 261
 262     my $keynames = {
 263         rsa => 'ssh_host_rsa_key',
 264         dsa => 'ssh_host_dsa_key',
 265         ecdsa => 'ssh_host_ecdsa_key',
 266         ed25519 => 'ssh_host_ed25519_key',
 267     };
 268
 269     my $hostname = $conf->{hostname} || 'localhost';
 270     $hostname =~ s/\..*$//;
 271     my $ssh_comment = "root\@$hostname";
 272
 273     my $keygen_outfunc = sub {
 274         my $line = shift;
 275
 276         print "done: $line\n"
 277             if $line =~ m/^(?:[0-9a-f]{2}:)+[0-9a-f]{2}\s+\Q$ssh_comment\E$/i ||
 278                $line =~ m/^SHA256:[0-9a-z+\/]{43}\s+\Q$ssh_comment\E$/i;
 279     };
 280
 281     # Create temporary keys in /tmp on the host
 282     my $keyfiles = {};
 283     foreach my $keytype (keys %$keynames) {
 284         my $basename = $keynames->{$keytype};
 285         my $file = "/tmp/$$.$basename";
 286         print "Creating SSH host key '$basename' - this may take some time ...\n";
 287         my $cmd = ['ssh-keygen', '-f', $file, '-t', $keytype,
 288                    '-N', '', '-E', 'sha256', '-C', $ssh_comment];
 289         PVE::Tools::run_command($cmd, outfunc => $keygen_outfunc);
 290         $keyfiles->{"/etc/ssh/$basename"} = [PVE::Tools::file_get_contents($file), 0600];
 291         $keyfiles->{"/etc/ssh/$basename.pub"} = [PVE::Tools::file_get_contents("$file.pub"), 0644];
 292         unlink $file;
 293         unlink "$file.pub";
 294     }
 295
 296     # Write keys out in a protected call
 297
 298     my $code = sub {
 299         foreach my $file (keys %$keyfiles) {
 300             $plugin->ct_file_set_contents($file, @{$keyfiles->{$file}});
 301         }
 302     };
 303     $self->protected_call($code);
 304 }
 305
 306 my $container_emulator_path = {
 307     'amd64' => '/usr/bin/qemu-x86_64-static',
 308     'arm64' => '/usr/bin/qemu-aarch64-static',
 309 };
 310
 311 sub pre_start_hook {
 312     my ($self) = @_;
 313
 314     return if !$self->{plugin}; # unmanaged
 315
 316     my $host_arch = PVE::Tools::get_host_arch();
 317
 318     # containers use different architecture names
 319     if ($host_arch eq 'x86_64') {
 320         $host_arch = 'amd64';
 321     } elsif ($host_arch eq 'aarch64') {
 322         $host_arch = 'arm64';
 323     } else {
 324         die "unsupported host architecture '$host_arch'\n";
 325     }
 326
 327     my $container_arch = $self->{conf}->{arch};
 328
 329     $container_arch = 'amd64' if $container_arch eq 'i386'; # always use 64 bit version
 330     $container_arch = 'arm64' if $container_arch eq 'armhf'; # always use 64 bit version
 331
 332     my $emul;
 333     my $emul_data;
 334
 335     if ($host_arch ne $container_arch) {
 336         if ($emul = $container_emulator_path->{$container_arch}) {
 337             $emul_data = PVE::Tools::file_get_contents($emul, 10*1024*1024) if -f $emul;
 338         }
 339     }
 340
 341     my $code = sub {
 342
 343         if ($emul && $emul_data) {
 344             $self->{plugin}->ct_file_set_contents($emul, $emul_data, 0755);
 345         }
 346
 347         # Create /fastboot to skip run fsck
 348         $self->{plugin}->ct_file_set_contents('/fastboot', '');
 349
 350         $self->{plugin}->pre_start_hook($self->{conf});
 351     };
 352     $self->protected_call($code);
 353 }
 354
 355 sub post_clone_hook {
 356     my ($self, $conf) = @_;
 357
 358     $self->protected_call(sub {
 359         $self->{plugin}->post_clone_hook($conf);
 360     });
 361 }
 362
 363 sub post_create_hook {
 364     my ($self, $root_password, $ssh_keys) = @_;
 365
 366     return if !$self->{plugin}; # unmanaged
 367
 368     my $code = sub {
 369         $self->{plugin}->post_create_hook($self->{conf}, $root_password, $ssh_keys);
 370     };
 371     $self->protected_call($code);
 372     $self->rewrite_ssh_host_keys();
 373 }
 374
 375 # os-release(5):
 376 #   (...) a newline-separated list of environment-like shell-compatible
 377 #   variable assignments. (...) beyond mere variable assignments, no shell
 378 #   features are supported (this means variable expansion is explicitly not
 379 #   supported) (...). Variable assignment values must be enclosed in double or
 380 #   single quotes *if* they include spaces, semicolons or other special
 381 #   characters outside of A-Z, a-z, 0-9. Shell special characters ("$", quotes,
 382 #   backslash, backtick) must be escaped with backslashes (...). All strings
 383 #   should be in UTF-8 format, and non-printable characters should not be used.
 384 #   It is not supported to concatenate multiple individually quoted strings.
 385 #   Lines beginning with "#" shall be ignored as comments.
 386 my $parse_os_release = sub {
 387     my ($data) = @_;
 388     my $variables = {};
 389     while (defined($data) && $data =~ /^(.+)$/gm) {
 390         next if $1 !~ /^\s*([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/;
 391         my ($var, $content) = ($1, $2);
 392         chomp $content;
 393
 394         if ($content =~ /^'([^']*)'/) {
 395             $variables->{$var} = $1;
 396         } elsif ($content =~ /^"((?:[^"\\]|\\.)*)"/) {
 397             my $s = $1;
 398             $s =~ s/(\\["'`nt\$\\])/"\"$1\""/eeg;
 399             $variables->{$var} = $s;
 400         } elsif ($content =~ /^([A-Za-z0-9]*)/) {
 401             $variables->{$var} = $1;
 402         }
 403     }
 404     return $variables;
 405 };
 406
 407 sub get_ct_os_release {
 408     my ($self) = @_;
 409
 410     my $code = sub {
 411         if (-f '/etc/os-release') {
 412             return PVE::Tools::file_get_contents('/etc/os-release');
 413         } elsif (-f '/usr/lib/os-release') {
 414             return PVE::Tools::file_get_contents('/usr/lib/os-release');
 415         }
 416         return undef;
 417     };
 418
 419     my $data = $self->protected_call($code);
 420
 421     return &$parse_os_release($data);
 422 }
 423
 424 sub unified_cgroupv2_support {
 425     my ($self) = @_;
 426
 427     $self->protected_call(sub {
 428         $self->{plugin}->unified_cgroupv2_support();
 429     });
 430 }
 431
 432 1;